Description
Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via unknown vectors that cause JavaScript to execute with the wrong principal, aka "Privilege escalation via incorrect principals."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.13~pre080323b-0etch1 | DSA-1534-2, DSA-1534-1 |
| Debian 4.0 | icedove | 1.5.0.13+1.5.0.15b.dfsg1+prepatch080417a-0etch1 | DSA-1574-1 |
| Debian 4.0 | iceweasel | 2.0.0.13-0etch1 | DSA-1535-1 |
| Debian 4.0 | xulrunner | 1.8.0.15~pre080323b-0etch1 | DSA-1532-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 1.5.0.12-14.el5_1 | RHSA-2008:0207 |
| RHEL 5 | thunderbird | 1.5.0.12-11.el5_1 | RHSA-2008:0209 |
| RHEL 4 | firefox | 1.5.0.12-0.14.el4 | RHSA-2008:0207 |
| RHEL 4 | seamonkey +5 | 1.0.9-15.el4 | RHSA-2008:0208 |
| RHEL 4 | thunderbird | 1.5.0.12-10.el4 | RHSA-2008:0209 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.16.el3 | RHSA-2008:0208 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.14.el2 | RHSA-2008:0208 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 1.5.0.12-11.el5_1 | RHSA-2008:0209 |
Advisories 8
- RHSA-2008:0209 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0208 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0207 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1534-1 iceape Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1532-1 xulrunner Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1574-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1534-2 iceape - regression Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1535-1 iceweasel Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20080327 rPSA-2008-0128-1 firefox mailing-list
- oval:org.mitre.oval:def:10980 vdb-entry signature
- 29541 third-party-advisory
- 29539 third-party-advisory
- http://www.mozilla.org/security/announce/2008/mfsa2008-14.html
- ADV-2008-0999 vdb-entry
- 30620 third-party-advisory
- 29560 third-party-advisory
- DSA-1532 vendor-advisory
- mozilla-principal-code-execution(41457) vdb-entry
- 30327 third-party-advisory
- 238492 vendor-advisory
- USN-592-1 vendor-advisory
- 29616 third-party-advisory
- 1019694 vdb-entry
- 29550 third-party-advisory
- 29645 third-party-advisory
- USN-605-1 vendor-advisory
- 29607 third-party-advisory
- 239546 vendor-advisory
- MDVSA-2008:155 vendor-advisory
- ADV-2008-1793 vdb-entry
- DSA-1574 vendor-advisory
- 29558 third-party-advisory
- 29548 third-party-advisory
- 30370 third-party-advisory
- RHSA-2008:0208 vendor-advisory
- 29526 third-party-advisory
- ADV-2008-2091 vdb-entry
- SUSE-SA:2008:019 vendor-advisory
- TA08-087A third-party-advisory
- 29391 third-party-advisory
- 30192 third-party-advisory
- VU#466521 third-party-advisory
- SSA:2008-128-02 vendor-advisory
- RHSA-2008:0209 vendor-advisory
- 28448 vdb-entry
- RHSA-2008:0207 vendor-advisory
- 30016 third-party-advisory
- DSA-1534 vendor-advisory
- FEDORA-2008-3519 vendor-advisory
- 29547 third-party-advisory
- 30105 third-party-advisory
- 30094 third-party-advisory
- GLSA-200805-18 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128
- 31043 third-party-advisory
- FEDORA-2008-3557 vendor-advisory
- ADV-2008-0998 vdb-entry
- DSA-1535 vendor-advisory
- MDVSA-2008:080 vendor-advisory